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Claims 

[cl] An apparatus for selecting the optimum location of a network service based on 

a user's geographical location and the configuration of the apparatus by 
transparently altering DNS messages, the apparatus comprising: 

a network node with at least two network interfaces, 

capturing data packets through the network interfaces, 

analyzing captured packets, 

determining the user's geo-location, 

modifying DNS packets according to the user's geo-location to direct the 
user to the optimum server. 

[c2] The apparatus as described in claim 1 , wherein the optimum location is the 

geographically the closest one. 

[c3] The apparatus as described in claim 1 , wherein the optimum location is that of 

geographically the closest server which has been determined healthy and 
actively serving users requests. 

[c4] The apparatus as described in claim 3, wherein the healthy server is the one 

generating timely and correct responses to user requests, 

[c5] The apparatus as described in claim 1 , wherein the optimum location is the 

preferred location based on specific criteria chosen by the service administrator. 

[c6] The apparatus as described in claim 1 , wherein the location of a network service 

is one of the locations of many mirrored servers that are connected via a 
network. 

[c7] The apparatus as described in claim 1 , wherein a network service is an Internet 

network service. 

[c8] The apparatus as described in claim 1 , wherein a network service is an 

enterprise network service. 

[c9] The apparatus as described in claim 1 , wherein the configuration of the 

apparatus is a set of rules to control the optimum server selection process. 
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[cl 0] The apparatus as described in claim 1 , wherein transparently altering DNS 

messages is to capture and to modify the content of the DNS messages by 
operating at OSI model's second layer which is transparent to Internet Protocol 
(IP) users. 

[cl 1] The apparatus as described in claim 1 , wherein the network node is a device 

attached to networks via at least two network interfaces. 

[cl 2] The apparatus as described in claim 1 , wherein the network node captures every 

packet detected on any of it interfaces. 

[cl 3] The apparatus as described in claim 1 , wherein the network node analyzes the 

captured packets to determine network addresses, protocol port numbers, 
protocol message types, and specific protocol fields. 

[cl 4] The apparatus as described in claim 1 , wherein the network node determines 

the source IP address of the captured DNS message and consults Its previously 
built database to determine the geographical location of the user that has sent 
the DNS message. 

[cl 5] The apparatus as described in claim 1 , wherein the network node modifies the 

captured DNS messages according to the geo-location of the DNS user to 
inform the user with the IP address of the optimum server. 

[cl 6] The apparatus as described in claim 1 , wherein the network node forwards 

every packet, which is not a DNS message, to the other interface. 

[cl 7] A method for selecting the optimum location of a network service based on a 

user's geographical location and the configuration of the method by 
transparently altering DNS messages, the method comprising: capturing data 
packets, analyzing captured packets, determining the user's geo-location, 
modifying DNS packets according to the user's geo-location to direct the user 
to the optimum server. 

(cl 8] The method as described in claim 1 7, wherein the optimum location is the 

geographically the closest one. 
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[cl 9] The method as described in claim 1 7, wherein the optimum location is that of 

geographically the closest server which has been determined healthy and 
actively serving users requests. 

[c20] The method as described in claim 1 9, wherein the healthy server is the one 

generating timely and correct responses to user requests. 

[c21] The method as described In claim 17, wherein the optimum location is the 

preferred location for some users based on some criteria chosen by the service 
administrator. 

[c22] The method as described in claim 1 7, wherein the location of a network service 

is one of the locations of many mirrored servers that are connected via a 
network. 

[c23] The method as described in claim 1 7, wherein a network service is an Internet 

network service. 

[c24] The method as described in claim 17, wherein a network service is an enterprise 

network service. 

[c25] The method as described in claim 17, wherein the configuration of the method 

is a set of rules to control the optimum server selection process. ^ 

[c26] The method as described in claim 1 7, wherein transparently altering DNS 

messages is to capture and to modif/ the content of the DNS messages by 
operating at OSI model's second layer which is transparent to Internet Protocol 
(IP) users. 

[c27] The method as described in claim 1 7, wherein the method analyzes the 

captured packets to determine network addresses, protocol port numbers, 
protocol message types, and specific protocol fields. 

[c28] The method as described in claim 1 7, wherein the method determines the 

source IP address of the captured DNS message and consults its previously built 
database to determine the geographical location of the user that has sent the 
DNS message. 
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[c29] The method as described in claim 1 7, wherein the method modifies the 

captured DNS messages according to the geo-location of the DNS user to 
inform the user with the IP address of the optimum server. 

[c30] The method as described in claim 1 7, wherein the method forwards every 

packet, which is not a DNS message. 
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